Skip to main content

Security

Kafka Gateway sits between your clients and your Kafka brokers, so it needs its own credentials and encryption settings for the broker connection, separate from however clients authenticate to Kafka Gateway itself.

This section covers securing that broker connection, configured on the kafka client binding and its exit chain in zilla.yaml:

  • SASL: authenticate to the Kafka brokers with PLAIN, SCRAM, or OAuthBearer.
  • TLS: encrypt the connection to the Kafka brokers, optionally with mutual TLS client certificates.

SASL and TLS are independent and commonly combined: SASL for broker authentication, TLS for encrypting the connection that carries it.

Client-Facing Authentication

Authenticating the clients that connect to Kafka Gateway (over HTTP, MQTT, gRPC, SSE, or WebSocket) is a separate concern, handled by guards rather than the Kafka client binding. See the JWT, API Keys, Azure AD, AWS Lambda, and Inline guard reference docs.